* feat(release): post-publish verifier — clean-container install + boot (WS1.4)
verify-published.mjs installs the PUBLISHED version from the public registry
inside node:24-slim and boots it until /api/monitoring/health returns 200 with
the expected version — validating the exact bytes users install, on a machine
with no repo/devbox state. Version + knobs travel as docker env vars, never
interpolated into the container script (Hard Rule #13); strict semver arg
validation. Wired into the release Phase 4 monitoring playbook.
Live evidence: omniroute@3.8.48 from the real registry installed and booted in
a clean container — HTTP 200, version 3.8.48, exit 0.
Tests: 4 pure-function guards (semver strictness incl. shell-hostile rejects,
env-passing invariant, clean-image pin, health-poll source guard).
* chore(quality): allowlist verify-published container env vars in env-doc-sync
